Method for inducing upgrading of an expandable product

ABSTRACT

The security modules used in pay television and in other applications using any screen means are called to evolve and thus to be replaced. In order to favour this replacement of a previous generation by a new one the method according to the invention consists in sending by a control centre in the data flux a replacement prompt command including the minimal characteristics of the security module of the new generation, establishing the characteristics of the security module being used, and comparing with the minimal characteristics defined by the received command, and according to the results of this comparison, starting a prompt cycle by sending a warning indication on the screen.

[0001] The present invention concerns a method for the updating of anevolutionary product, particularly in the field of smart cards.

[0002] All the operators that use electronic and computer systems arefaced with the updating of their products and the management ofcompatibility between the different versions. This matter is veryimportant as the number of these products is very big and they aredistributed on a large scale.

[0003] As these products are linked, even sporadically, to a managementcentre, the first approach of the operators has been to make thissoftware modifiable by downloading. This technique has been possiblethanks to the EEPROM or Flash memories that accept reprogramming andthat do not need permanent powering.

[0004] In this way, when new functions appear, the downloading of thenew software in these products allows the users to benefit from thesefunctions without having to return their products to any technicalcentre.

[0005] In a one-way configuration, that is, a configuration in whichonly the link between the operator and the user is possible, it isdifficult, even impossible, to determine if all the users have receivedthe updating.

[0006] Thus, the operators are forced to assume the compatibility withseveral versions in parallel so that the users that have not receivedthe updating can benefit from the proposed service.

[0007] This example can even be intensified when changing the generationof the product, that is, that a physical replacement of the product isnecessary.

[0008] For this purpose the operators send the users the new generationof the product with the invitation of using this new product in theplace of the previous one.

[0009] When it is an operator that proposes a payment service it is verydifficult to impose the use of the new product suppressing allcompatibility with the old product. This would provoke dissatisfactionin the clients who feel little interest in considerations of a technicalnature.

[0010] This is why the operators are at present constrained, out of fearof letting down their clients, to ensure not only the compatibilitybetween the software versions, but also between the materialgenerations. This compatibility is costly in pass-band terms whencommunicating with the products as the commands must be sent accordingto all the criteria of the different versions.

[0011] The objective of the present invention is a method that promptsthe user to update his/her product when it is possible, and not when thecentre ceases to support the version used by the user causing thestopping of the service.

[0012] This objective is achieved by a method consisting in determiningthe current version of the user's product and in comparing this versionwith the minimal intended version, and if the user's version is aprevious one to the minimal version, producing a temporary visual promptin the user's terminal.

[0013] According to one embodiment, the product is a smart card thatcontrols the access to a pay television. This card allows supplying thenecessary information to decode the numerical flux and to manage thesubscriptions to the different services offered by the operator. Thiscard is connected to a pay television decoder that sends the decodedsignals to a screen. The process intended to convince the user to changehis/her card is started by the management centre that sends, by theclassical communication means, a prompt inviting to update thesubscriber's decoders.

[0014] Thus, according to the invention, the service given to the useris not interrupted but momentarily interfered in order to prompt theuser to change his/her card for a more recent version.

[0015] According to a first embodiment, this interference or warningindication is carried out by adding a message on the screen during ashort time in order to remind the user to change his/her card.

[0016] This apparition can be done on command of the card itself and berepeated. The frequency of repetition can vary in time so that thewarning indication becomes annoying to the user. In this way for examplefrom one apparition per day it will be increased to one apparition perhour if no action is taken by the user.

[0017] This warning indication is equally advantageously done whenstarting the decoder.

[0018] Instead of a text message it is possible to add a pictogram, evena sequence of images describing the stages for changing the card.

[0019] According to one embodiment, this warning indication is not donein the form of a message but in the form of a simulation of a momentaryreception breakdown. All or part of the screen is briefly interferedwith a notable effect on the user. The user will then be ready toreplace his/her card as soon as possible so as not to see any more theimages disappear before him/her.

[0020] A simple means for doing this function is to use the controlwords necessary to decode the numerical flux. These control words arecalculated by the card, precisely the one that has to be replaced. It isthen possible for this card to not supply a word and to provoke theinterference on the screen, the decoder being unable to decode thenumerical flux.

[0021] Alternatively this control word can be supplied with a delay,during which the screen will be interfered.

[0022] It is possible to mix both warning indication means, that is, ifthe user does not react to the invitation made in the form of a message,the method of interference of the image will confirm the need to do thechange.

[0023] Other important aspects of the invention are the determination ofthe card's version and of the moment to perform the warning.

[0024] Smart cards used in pay television decoders contain a relationaldatabase. Such an organisation is described in the document EP 0 616 714and tells us that the base does not contain only the data but that italso contains programmes. Due to the relational organisation of thisinformation (data and programmes) it is necessary to carry out a requestof information to determine which is the state of the version of thedatabase.

[0025] To determine the convenient moment to warn the user, severalcriteria have to be taken into account. It is clear that if the user iswatching a film that he/she has especially purchased, it will be out ofthe question to interfere with the user's pleasure during this service.It will be best to choose emissions included in the basic subscriptionand with a low emotional character as opposed to a sports competition.

[0026] The control centre, in this type of setting, does not only send atarget version number as a minimal condition to not interfere the user'sscreen. The centre can also condition this version to the presence ofcertain programmes in the database.

[0027] In the case where the control centre receives return informationfrom the different decoders, it is possible for the centre to determineitself the cards that need an updating. The control centre has means toaddress each card nominatively to order it the starting of theinvitation process to change. This process can be interrupted either bythe actual changing of the card of by a command from the control centre.

[0028] Other forms of warning, for example sonorous, can equally be usedin the range of this invention.

[0029] The use in a pay television system is not the only possibleapplication. The generalisation of the pay services linked to Internetstarts also security modules connected to user's computers. When achange is needed, for example to integrate new functions or to change acoding algorithm, the same problem is presented and the presentinvention allows to prompt the user to change the security module.

[0030] This prompt will take the form of a message on the screen, asound, or a graphical animation.

[0031] Another possibility is to slow down the performances of thesecurity module each time it is requested. Thus a slowing is performedof the functions of this module, a slowing that is accompanied by amessage indicating the user the means to recover the originalperformances.

[0032] The single FIGURE illustrates the system according to theinvention that comprises a control centre 1 linked with one or severalsubscriber units composed of a receiver/decoder 2, a security module 3,and a screen 4. For the good functioning of the operations relating tothe security of the received data 5, even the sent ones 6, the securitymodule 3 is induced to supply the required keys or cryptograms.

[0033] One embodiment consists in including in the updating promptmessage an information telling the user that he/she will benefit fromcertain advantages or supplementary services after changing the securitymodule. These advantages can be for example in the form of asupplementary credit, a free viewing of a film or an extension of thesubscription period.

[0034] In a two-way system (pay television, Internet) the updating ofthe module is detected by the control centre that receives the data fromthe new module by means of the return channel. The control centre thentransmits the necessary data to the security module allowing theintroduction of the advantages or supplementary services.

[0035] In the case where there is no return channel (one-way) thechanging of the module is not detected by the control centre. The dataflux transmitted by the latter then contains specific data destined tothe new module that includes functions that are ready to supply theseadvantages to the user. A variant of this implementation is possible bythe introduction of conditions of granting supplementary services in thesecurity module. From its starting it verifies the conditions of accessgiving the right to these supplementary services, and if theseconditions are fulfilled in accordance with these services. They canhave, for example, the form of a supplementary subscription to a channelduring a limited time of a month.

1. A method to favour the replacement of a security module of a previousgeneration for that of a new generation in a user unit connected to saidsecurity module and receiving a flux of data from at least one controlcentre defining a plurality of services, said user unit comprising atleast one screen, characterised in that it consists in: sending by thecontrol centre in the data flux a replacement prompt command includingthe minimal characteristics of the security module of new generation;establishing the characteristics of the security module being used andcomparing with the minimal characteristics defined in the receivedcommand, and according to the results of the comparison, starting aprompt cycle by sending a warning indication to the screen.
 2. A methodaccording to claim 1, characterised in that the warning indication isdone in the form of a text message on all or part of the screen.
 3. Amethod according to claim 2, characterised in that the warning containsinformation relating to the granting of supplementary servicestransmitted by the control centre, said granting being determined byconditions of replacing the security module.
 4. A method according toclaim 1, characterised in that the warning indication is done in theform of one or several graphical images on all or part of the screen. 5.A method according to claims 1 to 4, characterised in that this warningindication is accompanied by a sonorous signal, in a musical or verbalform.
 6. A method according to claims 1 to 5, characterised in that thesecurity module is a smart card containing a relational database andthat the establishment of characteristics of the security module beingused is done by a request of a relational type on said base.
 7. A methodaccording to any of the preceding claims, characterised in that thewarning indication is reproduced according to a determined cycle.
 8. Amethod according to any of the preceding claims, characterised in thatthe warning indication is carried out by creating a delay in theinformation supplied by the security module.
 9. A method according toany of the preceding claims, characterised in that the user's unit is apay television decoder and that the security module is responsible forthe supply of the decoding keys of a pay television flux, and that thewarning indication is done by interrupting the supply of said keys or bymodifying them.
 10. A method according to claim 9, characterised in thatthe data flux comprises indications as to the nature of the transmittedemissions and that the warning indication takes into account the natureof these emissions being seen.
 11. A method according to claim 1,characterised in that when introducing the new module, the lattercomprises means to transmit an initialisation message to the controlcentre containing conditions of replacement, said control centre grantsaccess to one or several supplementary services.
 12. A method accordingto claim 1, characterised in that the data flux transmitted by thecontrol centre contains specific messages destined to authorise accessto one or several supplementary services only if the security module isupdated.
 13. A method according to claim 1, characterised in that thesecurity module contains data relating to the conditions of grantingsupplementary services, from its starting, said module checks accessconditions to the supplementary services and allows these supplementaryservices only if the granting conditions are fulfilled.